Cloud-native Windows endpoints might be easier to achieve than you think

Many organisations have now adopted a hybrid modern workplace environment with user identities in on-premises Active Directory (AD), synchronised to Entra ID using Microsoft Entra Connect (formally Azure AD Connect) or Connect cloud sync. Typically devices are hybrid joined, enabling them to sign in to both cloud and on-premises resources too. This gives your users the ability to single sign on (SSO) to your cloud applications.

However, Hybrid join has its issues and complexities. Microsoft now recommend using Entra joined devices where possible¹, due to the simplicity of device deployment and management, but how do you achieve this?

A common misunderstanding is that in order to start using Entra joined devices, you need to have made all of your applications cloud-native, or deploy a cloud application proxy, but it might not be that difficult.

Microsoft Entra join allows devices to be registered directly with Entra ID, providing a unified identity for accessing both cloud and on-premises resources. This approach is suitable for organisations of all sizes and can be used in both cloud-only and hybrid environments. Key benefits include:

Entra Connect SSO enables Entra joined devices to sign on to on-premises resources that rely on Active Directory, for example, printers, file shares, or applications. It does this by synchronising on-premises user and domain information to Entra ID. When the signed on user wants to access an on-premises resource the device:

1. Sends domain information and user credentials to a discovered Domain Controller to authenticate the user.

2. Receives a token used to authenticate to the on-premises resource.

Although there are some prerequisites such as ensuring line of sight communication with your domain controllers, functioning DNS, and certain attribute synchronisation, it’s possible that Entra join may just enable you to sign on to the resources your users need without much additional configuration. It really can be that straightforward.

^{Sources:
1 Join your cloud-native endpoints to Microsoft Entra - Microsoft Intune | Microsoft Learn}